Re: [dnsext] Historical root keys: The Large Router Vendor Speaks

[Andrew Sullivan <[e-mail]>]

No hat.

On Fri, Jan 28, 2011 at 11:21:39AM -0500, John Bashinski wrote:
> Is there some particular S/MIME or PGP key that's guaranteed to be used
> to sign every update in the future

> Same question... if I wake up several years from now, is the
> root key for that CA going to be the same, or am I going to be
> able to trace a path from the key I have to the current key?
> 
> The overriding requirement is that a device be able to choose its trust
> anchor with no human intervention, based on information that may be
> several years old.

That amounts to a requirement that someone guarantee a key is not
compromised.  Nobody can promise that.  This is why I am sceptical of
claims that some mechanism other than DNSSEC keys is the right way to
do this.  I don't see why it's more harmful to say, "Replay the 5011
rollovers as they happened through history," with the possible
exposure that one of those was compromised (the compromise being the
reason for the rollover, than it is to say, "Trust this key forever."
I see no reason to suppose one of those keys more likely to be
corrupted than the other, in the case where one is doing regular key
rolls.

If one is _not_ doing regular key rolls, then things are different.
In that case, of course the presence of a mismatch is either an attack
or a roll because of compromise.  But at that point, it seems to me,
one does not want anything automatic.  One wants analysis of the
situation, no?  (Why was the key compromised?  What evidence is there
that only that key was compromised?  &c.)

> One thing to remember that may bear on this, by the way: a lot of
> these products won't have any security-quality assurance that they
> know the date or time even *after* they come up, let alone when
> they're first trying to get DNS working.

They're going to have a hard time with DNSSEC signatures if they don't
have accurate time.

> I'm not sure compromise is quite as black and white as you've presented
> it, though. In a limited compromise, we might still get more assurance
> from relying on the old key for a rollover than from relying on
> *nothing* for a rollover.

I don't want to put words in Wouter's mouth, but I believe this to be
one of the underlying assumptions of the trust-history draft.  Indeed,
it seems to me that if you have a real compromise, you can just not
publish that event in the trust history.

A

-- 
Andrew Sullivan
[e-mail]
Shinkuro, Inc.